I had similar issue for one of our clients. My strategy to not affect legit users was to enable mitigations if global traffic crossed some threshold.

eg. in your case this could mean if traffic is above eg. 75QPS then captcha is enabled, and if it's below that it's disabled.

I don't know what tech stack you are using, but nice trick that i figured out was to abuse rate limiting to detect global traffic (doing if branch with rate limit with const as client id)